Animated Diagnostic Flow
Each stage reduces ambiguity and moves the operator toward a confident next action.
Capture
Closure signal enters pipeline
App identity, timestamps, and termination metadata are captured locally.
Correlate
Evidence window assembled
Unified logs, crash markers, and policy indicators are aligned around the event.
Classify
Dominant cause selected
Deterministic rules produce cause + confidence, with caveats when evidence is mixed.
Decision
Recommended action surfaced
The operator gets a clear next move plus export-ready handoff context.
Unsure branch
Low confidence never fakes certainty
If evidence is limited, WhyDidItClose marks uncertainty and requests additional validation.
Confidence reflects evidence quality, not optimism.
Interactive Diagnosis JSON Demo
Paste a diagnosis payload to preview how support/QA reads cause, confidence, and action before escalation.
Operator interpretation
How It Works
WhyDidItClose translates low-level termination evidence into a clear operator decision.
Pipeline
1. Capture
The monitor records app identity, timing, and termination metadata when an app exits.
2. Correlate
Around the event window, WhyDidItClose aligns local OS-observable evidence such as lifecycle events, unified log clues, and crash/policy markers.
3. Classify
A deterministic rules engine maps signals to dominant cause and confidence level.
4. Recommend
The output includes a concise explanation and practical next step for faster triage.
5. Unsure Branch
If evidence is limited, WhyDidItClose does not fabricate certainty. It labels the result as lower confidence and suggests additional validation steps.
Confidence Rubric
| Confidence | Meaning | Operator action |
|---|---|---|
| High | Strong direct OS-level evidence | Execute recommendation and attach export in handoff |
| Medium | Strong but not definitive evidence | Validate one adjacent signal before escalation |
| Low | Limited evidence and higher ambiguity | Gather additional logs and re-run diagnosis |
Example Incident Translation
Raw Situation
- User reports: "The app closed by itself"
- Evidence shows abrupt process termination with external quit attribution
WhyDidItClose Output
{
"app": "Antigravity",
"cause": "force_quit",
"confidence": "high",
"summary": "The app was terminated by an external quit action.",
"next_action": "Review recent user/system quit triggers and reproduce with event timeline evidence."
}
Operational Result
Teams move from ambiguous closure reports to consistent, actionable incident triage.